From c716ad6fc4ae46602fd959b67b3de59674416553 Mon Sep 17 00:00:00 2001 From: EricDunsworth <1907279+EricDunsworth@users.noreply.github.com> Date: Wed, 28 Aug 2024 08:48:32 -0400 Subject: [PATCH] Patch - Field flow: Keep URL params matching HTML attributes (#2407) When field flow's redirect (redir) action is used, submitting causes the plugin to "transform" the currently-selected dropdown option's URL parameters into hidden input elements. The inputs are created by passing "raw" HTML strings to the jQuery object. That setup used to play nicely with URL parameters whose keys corresponded to the names of HTML attributes (e.g. lang=anything). But it stopped working when wet-boew/wet-boew#9210 introduced DOMPurify into WET's jQuery 2.x implementation. Why? Because DOMPurify's sanitize() method filters-out name="[any HTML attribute name]" to prevent potential DOM clobbering attacks (see cure53/DOMPurify#980). End result is that jQuery ultimately returns name-less inputs to the plugin, which in turn causes affected parameters to go missing. This fixes it by using "pure" JavaScript (instead of jQuery) to create the inputs. Also adds a query string example to the redirection demo (with a mix of key naming schemes). Fixes #2406. Co-authored-by: Pierre Dubois --- components/wb-fieldflow/fieldflow-en.html | 6 +++--- components/wb-fieldflow/fieldflow-fr.html | 6 +++--- components/wb-fieldflow/fieldflow.js | 13 +++++++++---- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/components/wb-fieldflow/fieldflow-en.html b/components/wb-fieldflow/fieldflow-en.html index 38b286a1f..961e9df64 100644 --- a/components/wb-fieldflow/fieldflow-en.html +++ b/components/wb-fieldflow/fieldflow-en.html @@ -6,7 +6,7 @@ tag: fieldflow parentdir: fieldflow altLangPage: fieldflow-fr.html -dateModified: 2024-04-08 +dateModified: 2024-08-27 ---